On 05/06/17 08:06, Y Song wrote: > On Fri, Jun 2, 2017 at 7:42 AM, Edward Cree <ec...@solarflare.com> wrote: >> Test "helper access to variable memory: stack, bitwise AND + JMP, correct >> bounds" is listed as expected to pass, but it passes zero in the 'size' >> argument, an ARG_CONST_SIZE, to bpf_probe_read; I believe this should fail >> (and with my WIP patch it does). > Probably a typo or mis-statement. "size" is not passed in with "zero", but > with an unknown value. Hence, it probably should fail. > > BPF_MOV64_IMM(BPF_REG_2, 16), > BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128), > BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128), > BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 64), > BPF_MOV64_IMM(BPF_REG_4, 0), > BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2), > BPF_MOV64_IMM(BPF_REG_3, 0), > BPF_EMIT_CALL(BPF_FUNC_probe_read), So, in fact this unknown value is really 16 & 64 == 0, but the verifier doesn't know that and concludes that it's either 0 or 64 (after the AND). But then what I didn't spot before, and now have, is that the BPF_JGE tests if 0 >= size. Since we're in the false branch, that means size > 0, and so we're fine. The test case is correct, and now that I've fixed the min/max tracking in my patches, the verifier accepts it again.
-Ed
